Re: [go-nuts] how to address security concerns about a JIT

2022-12-18 Thread Robert Engels
If you limit the JIT capabilities a bit - have it compile to a Go plugin and load that. Since you need api boundaries to call into the code anyway - it fits nicely. > On Dec 18, 2022, at 5:10 AM, Jason E. Aten wrote: > >  > > Perhaps I am worrying too much. > > After all, a webserver that

Re: [go-nuts] how to address security concerns about a JIT

2022-12-18 Thread Jason E. Aten
Perhaps I am worrying too much. After all, a webserver that doesn't call into to the hypothetical JIT package won't even have that code linked into its binary; so it would not add any attack surface in that case. And the alternative at the moment is to use a C based mechanism, which will in all c

[go-nuts] how to address security concerns about a JIT

2022-12-18 Thread Jason E. Aten
I've long wished for a Go package that provided an API into the Go compiler to allow JIT compilation and loading of Go code into a running process. The compiler being written in Go already means this would be technically not super difficult. There are many applications for JIT compilation in Go.